feat: professionalize platform release 0.3.13

.github/workflows/ci.yml

@@ -24,6 +24,8 @@ jobs:
         run: python -m pip install --disable-pip-version-check uv==0.10.0
       - name: Sync locked dependencies
         run: uv sync --frozen --all-groups
+      - name: Install Chromium for mandatory browser tests
+        run: uv run playwright install --with-deps chromium
       - name: Secret scan
         uses: trufflesecurity/trufflehog@v3.79.0
         with:
@@ -47,6 +49,13 @@ jobs:
           IMAP_ENABLED: "0"
           OLLAMA_ENABLED: "0"
         run: ./scripts/codex_verify.sh
+      - name: Upload browser failure artifacts
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: browser-failure-artifacts
+          path: artifacts/browser-tests/
+          if-no-files-found: ignore
 
   container:
     runs-on: ubuntu-latest
@@ -64,5 +73,17 @@ jobs:
           severity: HIGH,CRITICAL
           exit-code: "1"
           ignore-unfixed: true
+      - name: Generate CycloneDX software bill of materials
+        uses: aquasecurity/trivy-action@0.30.0
+        with:
+          image-ref: vacatureradar:ci
+          format: cyclonedx
+          output: vacatureradar-sbom.cdx.json
+          scan-type: image
+      - name: Upload software bill of materials
+        uses: actions/upload-artifact@v4
+        with:
+          name: vacatureradar-sbom
+          path: vacatureradar-sbom.cdx.json
       - name: Inspect image configuration
         run: docker image inspect vacatureradar:ci > /tmp/image-inspect.json